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MFMA Circular No. 65 

Municipal Finance Management Act No. 56 of 2003 


Internal Audit and Audit Committee 


Purpose 

This Circular provides information to assist municipalities and municipal entities improve the 
effectiveness of internal audit and audit committees. 

A functional internal audit unit, systems of internal control and effective operation of an audit 
committee are all crucial components for sound corporate governance in municipalities. The 
MFMA requires that these financial governance components exist within all municipalities 
and every municipal entity. 

Recent audit findings however, have highlighted serious deficiencies in governance 
arrangements; there is a need to improve the internal audit function and audit committees as 
this would contribute to changes in financial management in the vast majority of 
municipalities. 

The Auditor-General has alluded to deficiencies stemming from a lack of knowledge or 
disregard of legislation and processes by councillors and officials, a failure to appoint 
suitably qualified key individuals to specifically legislated tasks and an inability or disregard 
by municipalities to establish and maintain the appropriate control systems which provide the 
basis of the governance framework. 

This Circular addresses the legal framework surrounding internal audit and audit committees 
and provides detailed guidance and advice on how municipalities must implement and 
manage these systems of accountability and governance. Failure to implement the 
legislative requirements surrounding internal audit and audit committees constitutes a 
serious breach of the MFMA. 

It is therefore critical that the contents of this Circular are read and implemented by senior 
management and council and in particular internal audit and audit committee. The role to be 
played by internal auditors and audit committees has been legislated in the MFMA and is 
critical to provide a mechanism for the rendering of impartial advice and recommendations to 
the municipal manager and council on financial and non-financial matters, to improve 
accountability and governance over the activities of municipalities and municipal entities. It 
is important therefore that the mayor and municipal manager effectively and regularly 
engage with the internal auditor and audit committee. 

Many or indeed the majority of audit findings can be addressed through recommendations 
made by internal audit and oversight by the audit committee. The responsibilities of internal 
audit and audit committee include providing assurance on the processes and procedures to 
be followed to enable decision-making and enhance accountability. Therefore, it is 
becoming of critical importance that greater emphasis be placed on the work of internal audit 
and the audit committee. It is also expected that council oversight structures in general 
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would derive immediate benefits through a closer interaction between council and senior 
management, and internal audit and audit committee. 

Legal framework 

In terms of section 216(1)(c) of the Constitution of the Republic of South Africa, (Act 108 of 
1996), national legislation must prescribe measures to ensure both transparency and 
expenditure control in all spheres of government by introducing uniform treasury norms and 
standards. 

Good governance involves how an organization is managed, its organizational culture, 
policies, strategies and the way it deals with its stakeholders. The internal auditor and audit 
committee provide objective, independent advice to improve oversight, governance and help 
to mitigate risks. 

Working with the internal auditor, the audit committee brings different skills and expertise to 
assist in improving the performance of an institution. The internal auditor and audit 
committee does not assume any management functions nor should management exert any 
undue influence over the work of the internal auditor and audit committee. 

Section 165 of the MFMA requires that each municipality and each municipal entity must 
have an internal audit unit. The internal audit unit of a municipality or municipal entity must: 

• Prepare a risk based audit plan and an internal audit program for each financial year; 

• Advise the accounting officer and report to the audit committee on the implementation of 
the internal audit plan and matters relating to: 

- Internal audit; 

- Internal controls; 

- Accounting procedures and practices; 

- Risk and risk management; 

- Performance management; 

- Loss control; 

- Compliance with this Act, the annual Division of Revenue Act and any other 
applicable legislation; and 

• Perform any such other duties as may be assigned to it by the accounting officer. 

It also provides that the internal audit function may be outsourced if the municipality or 
municipal entity requires assistance to develop its internal capacity and the council of the 
municipality or board of directors of the entity has determined that this is feasible or cost- 
effective. 

Section 166 of the MFMA requires that each municipality and municipal entity must have an 
audit committee. The audit committee must advise the municipal council, the political office- 
bearers, the accounting officer and the management of the municipality or municipal entity 
on matters relating to: 

• Internal financial control and internal audits; 

• Risk management; 

• Accounting policies; 

• The adequacy, reliability and accuracy of financial reporting and information; 

• Performance management; 

• Effective governance; 
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• Compliance with the Act, the annual Division of Revenue Act and any other applicable 
legislation; 

• Performance evaluation; and 

• Any other issues referred to it by the municipality or municipal entity. 

Furthermore, a single audit committee may be established for a district municipality and the 
local municipalities within that district municipality and for a municipality and municipal 
entities under its sole control. 


Part 1 

Audit Committees 

The audit committee operates as a committee of the council. The audit committee performs 
the responsibilities assigned to it by the MFMA (sections 165 and 166), and the corporate 
governance responsibilities delegated to it under its charter by the council. 

A charter is the written terms of reference approved by the council which outlines the 
mandate of the audit committee. The charter becomes the policy of the audit committee 
which then informs the contracts of the audit committee members. 

A charter should be used to guide the activities of an audit committee on an ongoing basis. 
A clear, well written charter should set out the objectives, roles and responsibilities, 
composition, structure and membership requirements, relationships with other stakeholders, 
authority for the committee to conduct enquiries and access municipality and municipal 
entity’s records and personnel, outlines procedures for meetings, addresses the 
confidentiality and independence of committee members, and provides for ethical conduct 
and reporting. 

Following approval, the audit committee charter should be published on the municipal 
website to promote awareness to all stakeholders. 

The charter should be reviewed annually and updated to ensure relevance and consistency 
with the MFMA, Municipal Systems Act (No 32 of 2000) and other related regulations, 
guides and best practice. 

The charter should be used as a basis for: 

• Preparing the audit committee’s annual work plan; 

• Setting the agenda for meetings; 

• Requesting skills and expertise; 

• Making recommendations to the accounting officer and municipal council; 

• Assessing the audit committee’s performance by its members, municipal council, 
management, Auditor-General and internal auditors; and 

• Contributions and participation at meetings. 

Composition 

Section 166 provides for a minimum requirement for the composition of an audit committee. 
The audit committee must comprise of at least three (3) persons who are not in the employ 
of the municipality or municipal entity. 
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In terms of best practice, the number and/or size of audit committees can be increased to 
address the requirements, peculiarities, and needs of the municipality or its entity which will 
also be guided by the approved charter. 

These requirements apply to all municipalities regardless of whether the audit committee is 
established through a shared service, or is outsourced through another mechanism. 

Appointment of Members 

Section 166(5) of the MFMA requires that the members of an audit committee must be 
appointed by the council of the municipality or, in the case of a municipal entity, by the 
council of the parent municipality. One of the members, who are not in the employ of the 
municipality or municipal entity, must be appointed as the chairperson of the committee. 
Councillors are not allowed to be members of an audit committee. The appointed members 
should enter into a contract with the municipality or municipal entity according to the 
approved terms of reference. 

Qualities of members 

One of the audit committee members should be appointed as the chairperson, after the 
following factors have been considered: 

• Flas good standing and ability to lead discussions; 

• Creates vision and provides direction at meetings; 

• Builds municipal capabilities by guiding management based on expert knowledge and 
skills; 

• Promotes and achieve quality outcomes at meetings; 

• Flas the ability to speedily and effectively advise council or the board of directors of any 
impending non-compliance with the legislative framework; 

• Flas the ability to encourage other members to participate in audit committee meetings; 
and 

• Conducts meetings in a manner that demonstrates a desire to establish effective 
communication with all stakeholders. 

In determining suitable candidates for an audit committee and maintaining a balanced 
composition, the accounting officer should seek to appoint candidates that have ability to: 

• Perform the role as advisor to management; 

• Communicate effectively with management; 

• Carefully review information received and obtain clarification from management as and 
when appropriate; 

• Raise relevant questions, evaluate responses and follow up on any matter that is 
unclear; 

• Conduct responsibilities in the context of the municipality’s strategic objectives and 
overall corporate governance of the council; 

• Act independently and be proactive in advising the accounting officer regarding issues 
that require further management attention; 

• Encourage openness and transparency; 

• Build relations with management; 

• Plave a professional approach to performing duties, including commitment of time and 
effort, and; 
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• Each committee member must be independent and appropriately skilled. 

Skills and experience 

Members should be selected from different areas of expertise to enhance the audit 
committee’s overall knowledge of the municipality or entity and the ability to discharge its 
obligations and provide appropriate recommendations to the council. 

The roles and responsibilities of an audit committee can be used as a baseline to obtain 
relevant skills that members must possess. This will ensure that appointed members are 
competent to carry out their responsibilities as set out in the audit committee’s charter. 

The appointed members should collectively possess the following skills and experience: 

• Private and public sector experience; 

• An understanding of service delivery priorities; 

• Good governance and/or financial management experience; 

• An understanding of the role of council and councillors; 

• An understanding of the operations of the organization; 

• Familiarity with risk management practices; 

• An understanding of internal controls; 

• An understanding of major accounting practices and public sector reporting 
requirements; 

• An understanding of public sector reforms; 

• Familiarity with legislation applicable to municipalities; 

• An understanding of the roles and responsibilities of internal and external auditors; 

• An understanding of the treatment of allegations and investigations; and 

• An understanding of the performance management system. 

The table below provides further guidance on the skills and experience of members that 
would enhance the audit committee representation and its performance to offer objective 
and quality advice. 


Skill Required 

Metro 

District with 

District 

Local with 

Local 



Services 

without 

Services 

without 




Services 


Services 

Financial Management 

V 

V 

V 

V 

V 

Legal 

V 

V 

V 

V 

V 

Admin and Governance 
(i.e. Internal Audit, Risk 
Management, IT, 

Human Resources, 
Planning, etc. 

V 

V 

V 

V 

V 

Performance 

Management 

V 

V 

V 

V 

V 

Medical practitioner, 
Engineers (i.e. Civil, 
Electrical, Environment 

V 

V 


V 



Except in the case of shared audit committees, the council must ensure that audit committee 
members do not serve on more than three local government audit committees 
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simultaneously as the practice of serving on too many committees has impacted negatively 
on performance of audit committees contributing to their ineffectiveness. 

Membership and Independence 

The audit committee should be independent and safeguarded from undue influence in 
exercising its responsibilities in an objective manner. To enhance the audit committee 
functioning, the following is required: 

• The audit committee chairperson and members should be independent of the 
municipality or municipal entity; 

• The audit committee chairperson and members should not be biased but exhibit an 
independence of mental attitude during deliberations; 

• All audit committee members should declare private and business interest in every 
meeting; and 

• All members should not carry out any business with the municipality or municipal entity. 

Term of Office 

To enhance independence of the audit committee, the term of office for members must be 
strictly adhered to. The chairperson should be appointed for a minimum of three years to 
ensure that he/she contributes most effectively and provides stability to the audit committee. 

Other audit committee members should serve at least a minimum of three years with an 
option to renew for another three years, based on performance. Recruitment of members 
should be staggered to prevent a loss of knowledge and skills in the committee. The 
recruitment process of new members should be concluded at least three months in advance 
of the expiry of existing members term. The head of internal audit and the accounting officer 
must maintain records of audit committee member contracts and ensure recruitment is 
undertaken as mentioned above. 

Rotation of members is encouraged as it enhances the independence of the audit 
committee. Members of the audit committee should not be contracted continuously for a 
period exceeding six years. After serving consecutively for six years, a cooling off period of 
two years should be provided for, before appointing the same member to the same audit 
committee. 

Members should be encouraged not to terminate their contracts until they have shared their 
knowledge with other new members. A committee member should give two months notice 
prior to resignation. 

The committee members should have the opportunity to have an exit meeting with the 
council to discuss the reason for leaving and to provide feedback on their experience on the 
audit committee as well as any other issues. The date of resignation should be minuted by 
the secretariat of the audit committee. 

Committee members can be dismissed by the municipal council under certain 
circumstances. The accounting officer or municipal council should consult the charter when 
dismissing members of the committee. Reasons for dismissal amongst other would 
normally be detailed in the letter of appointment and contract agreement, such as: 

• Where an on-going conflict of interest exists. 

• Where a member has not performed to expectations. 
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The official dismissal processes as they relate to the municipality or municipal entity should 
be adhered to by the Accounting officer and Municipal Council when an audit committee 
member is being dismissed. 

Where appropriate, the dismissal process should be linked to the charter and member’s 
performance assessment process. The dismissal of a member should be performed by the 
Municipal Council and the outcome of the dismissal process should be in writing. The date 
of dismissal should be minuted by the secretariat of the audit committee. 

Induction of members 

A formal process of induction must be facilitated by the chief audit executive in consultation 
with the accounting officer. During the induction of members, the roles and responsibilities 
of the audit committee must be clarified. The induction process should entail sufficient 
briefings and information on their roles, responsibilities, accountability and management’s 
expectations. Induction of members can also be facilitated by Provincial Treasury or National 
Treasury, upon request. 

New members should meet and be briefed by the accounting officer, chief financial officer, 
chairperson of the audit committee and the head of internal audit. New members should 
also be introduced to the external auditors. The information to be provided to new members 
should include: 

• The municipality’s governance and operational structures and how the audit committee 
operates within this structure; 

• Copy of the audit committee’s charter, including any policies, recent audit committee 
minutes, audit management letter, audit opinion, including details of outstanding issues, 
council resolutions and recommendations presented to the municipal council; 

• Copies of the relevant legislation; 

• Copies of the latest municipalities’ and entities’ annual report, annual financial 
statements, integrated development plan, budgets, service delivery and budget 
implementation plans, in-year reports, code of conduct, performance agreements, risk 
register and risk management plans; 

• Information from management and the internal auditor on the risk profile, status of 
internal controls and system of delegation; and 

• A copy of the internal audit charter and annual work plans, among others. 

Reporting 

The chairperson of the audit committee will report on a quarterly basis, or more frequently if 
required, to the municipal council on the operations of the internal audit unit and the audit 
committee. The report should include: 

• A summary of the work performed by the internal audit and the audit committee against 
the annual work plan; 

• Effectiveness of internal controls and additional measures that must be implemented to 
address identified risks; 

• A summary of key issues dealt with, such as significant internal and external audit 
findings, recommendations and updated status thereof; 

• Progress with any investigations and their outcomes; 

• Details of meetings and the number of meetings attended by each member; and 

• Other matters requested of the internal audit and audit committee. 
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The audit committee shall prepare a report annually which will be incorporated into the 
municipality’s annual report and those of its entities covering: 

• Describing the functions performed by the audit committee and meetings attended; 

• Resolutions taken by council and implementation status of recommendations made; and 

• Other relevant comments that may enhance governance and accountability. 

The chairperson of the audit committee must submit a copy of its report at least annually, or 
at other intervals, to the Municipal Public Accounts Committee (MPAC), for consideration 
during the MPAC engagements on the oversight report. The chairperson of the audit 
committee must always be available whenever MPAC needs clarity on the report of the audit 
committee. 

Therefore, the roles and responsibilities and outputs of the internal auditor and audit 
committee assist to inform the work of the MPAC and oversight structures. 

Authority 

The audit committee shall have the authority to perform functions, and to obtain any 
information and advice, from within or outside the municipality or entity, in order to perform 
its functions as legislated. Appropriate resources will be made available to the audit 
committee to perform its functions as agreed in its charter. 

The Audit Committee may: 

• communicate with the council, municipal manager or the internal and external auditors of 
the municipality or municipal entity; 

• have access to municipal records containing information that is needed to perform its 
duties or exercise its powers; 

• request any relevant person to attend any of its meetings, and, if necessary, to provide 
information requested by the committee; and 

• conduct investigations into the financial affairs of the municipality or municipal entity, as 
may be requested by the council of the municipality or in the case of a municipal entity, 
the council of the parent municipality or the board of directors of the entity. 

The MPAC, in discharging its responsibilities, may make use of any information provided by 
the audit committee to avoid duplication of effort. 

Remuneration of Members 

The members of the audit committee shall be remunerated for time spent in attendance of 
audit committee meetings. The municipality may utilise the rates provided by the National 
Treasury, from time to time. Should the accounting officer deem it necessary, he or she can, 
in consultation with the municipal council, determine other remuneration, provided that the 
charter properly define time and cost. 

Remuneration will only be applicable to officials employed outside the public service. No 
remuneration for participating in audit committees will be payable to officials employed at 
national, provincial and local government, its agencies or other entities regarded as falling 
within the definition of an organ of state, except for out of pocket expenses which may be 
reimbursed. The above will become effective for new members of audit committees, from 
the date of this Circular and for existing members, their current contracts will run its course. 
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The reimbursement of all members for travel expenditure must be determined in accordance 
with the approved council policy or the rate per kilometre as published and updated by the 
National Department of Transport. 

The accounting officer, in consultation with the chief financial officer, is required to approve 
the reimbursement of all travel expenditure for members of the audit committee based on 
the above mentioned or make alternative arrangements to pay for modes of travel to such 
meetings, in terms of council policy. 

The chairperson and members of the audit committee, including members who are 
employed in the public service, will be required to complete all particulars of their respective 
travel to and from the venue of the audit committee meetings. 

In the event that a senior official from one municipality is requested to serve as a member of 
an audit committee of another municipality, such senior official must first obtain written 
consent from the accounting officer before accepting such nominations. The remuneration 
discussion early will apply. 

Further guidance regarding the remuneration of audit committee members will be provided, 
from time-to-time. 

Performance Assessments 

The audit committee should assess its performance and achievements against its charter on 
an annual basis. The assessment would cover the performance of the individual member as 
part of the overall audit committee with reference to the particular skills the member has 
brought to the audit committee as a whole. 

The aim of the self-assessment is to ensure that the audit committee is meeting its 
objectives efficiently and effectively. The findings of the self-assessment should be 
presented by the chairperson to the accounting officer and municipal Council. 

Where the self assessment highlights a need for enhancements to the role, operational 
processes or membership of the committee, the chair should take action to ensure that such 
enhancements are implemented. The chairperson may need to consult with the accounting 
officer and municipal council to obtain appropriate support to ensure all enhancements are 
implemented. 

It may be beneficial for the audit committee to use an external facilitator to provide 
assistance with, or to supervise the self assessment process. It is up to the audit committee 
to decide whether the services of an external facilitator are required. 

An external facilitator can provide an impartial and objective view and can approach the 
evaluation process without bias or preconceived ideas. The chairperson and external 
facilitator should provide feedback to the audit committee members and present the findings 
of the evaluation to the accounting officer and municipal council. 

Where the audit committee is not performing in accordance with their charter and this has 
been observed by various stakeholders such as for example, internal audit, external audit or 
management, it would be appropriate for this or other issues to be brought to the attention of 
the accounting officer and municipal council. 
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If an individual audit committee member is not performing, then the member must be given 
an opportunity to address such with the municipal council. If it is considered necessary to 
terminate the services of an audit committee member prior to the end of the term of 
appointment, proper procedures should be followed. 

Roles and Responsibilities 

Internal Audit 

The audit committee must in relation to internal audit: 

• Ensure that the charter, independence and activities of the internal audit function are 
clearly understood and respond to the objectives of the municipality and the legal 
framework; 

• Regularly review the functional and administrative reporting lines of the internal auditor to 
ensure that the organizational structure is consistent with the principles of independence 
and accountability; 

• Review and approve the internal audit charter, including internal audit strategic plan; 

• Confirm that the annual audit plan makes provision for critical risk areas in the 
municipality and its entities; 

• Advise the municipality on resources allocated to give effect to the work outputs of the 
internal audit function; 

• Ensure that there is support for the internal audit unit and external auditors from senior 
management; 

• Confirm with management that internal audit findings are submitted to the audit 
committee on a quarterly basis; 

• Confirm actions taken by management in relation to the audit plan; 

• Consider and review reports relating to difficulties encountered during the course of the 
audit engagement, including any scope limitation or access to information reported to the 
accounting officer that remain unresolved; 

• Evaluate the performance of internal audit activity in terms of the agreed goals and 
objectives as captured in the audit plan; 

• Ensure that the head of internal audit has reasonable access to the chairperson of the 
audit committee; 

• Conduct a high-level review of internal audit on an annual basis, to ascertain whether the 
internal audit unit complies with the International Standards for the Professional Practice 
of Internal Auditing; 

• Concur with any appointment and termination of the services of the chief audit executive; 
Internal audit unit is accountable to the audit committee as follows: 

• Maintain open and effective communication with the audit committee; 

• Develop a flexible annual audit plan using a risk based methodology, addressing any 
weaknesses in risks or controls identified; 

• Submit the audit plan to the audit committee for review and approval; 

• Report on the implementation and results of the annual audit plan including special tasks 
requested by management and the audit committee; 

• Assist in drafting the agenda and documentation, and facilitate the distribution thereof to 
the audit committee in advance of meetings; 
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• Meet periodically with the chairperson of the audit committee to discuss whether the 
material and information furnished meets the requirements of the audit committee; 

• Obtain advice from the audit committee whether the frequency and time allocated to the 
committee is sufficient to attend effectively to all matters; 

• Cooperate with the audit committee as they conduct annual reviews of the performance 
of the internal audit function; 

• Submit the internal audit charter to the audit committee for review and approval on an 
annual basis and as necessary. 

External Audit 

The audit committee must in relation to external audit: 

• Take cognizance of the scope of work undertaken by the external auditor and the extent 
of co-ordination with the internal audit unit; 

• Review annual external audit plans, audit fees and other compensation; 

• Review reports and monitor management’s implementation of audit recommendations 
and municipal council resolutions in the new financial year; 

• Review the report on the financial statements and matters raised therein for reasonability 
and accuracy; 

• Review any interim reports issued in order to take cognizance of the issues raised in 
determining the follow up work of the internal audit; 

• Conduct a review of the extent to which previously reported findings by the external 
auditor have been addressed by the municipal council; 

• Provide advice to the accounting officer on actions taken relating to significant matters 
raised in external audit reports; 

• Liaise with the external auditors on any matter that the audit committee considers 
appropriate to raise with the external auditor; 

• Ensure that the external auditors have reasonable access to the management and 
chairperson of the audit committee; 

• Address any potential restrictions or limitations with the accounting officer and council; 
and 

• Address outstanding matters raised by the external auditors and any findings are dealt 
with conclusively in an expeditious manner. 

Annual Financial Statements 

The accounting officer must prepare Annual Financial Statements (AFS) of the municipality 
and municipal entity within two months after the end of the financial year to which to which 
those statements relate, submit the statements to the parent municipality of the entity (in the 
case of municipal entity) and to the Auditor-General for auditing. (This should be linked to 
the MFMA calendar). 

These financial statements should have been reviewed by the audit committee two weeks 
before submission to the Auditor-General. The process and timelines for audit committee 
meetings should be changed accordingly. The auditor and auditee should plan this process 
carefully to meet the determined timelines. 

The audit committee must review the annual financial statements to provide the municipality, 
or in the case of a municipal entity, the council of the parent municipality and the board of 
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directors of the entity with an authoritative and credible view of the financial position of the 
municipality or municipal entity by: 

• Confirming if the municipal audit file is prepared in line with the applicable standards and 
guidance contained in MFMA Circular 50, or as updated; 

• Reviewing the unaudited annual financial statements of the municipality and its entities 
to ensure that the quality, integrity and content is consistent with applicable standards 
and compliant with the legal framework; 

• Evaluating the annual financial statement of the municipality and its entities for 
reasonableness, completeness and accuracy, and provide comment thereon, on a timely 
basis; 

• Considering the Auditor-General’s opinion on the quality and appropriateness of the 
municipality’s accounting policies and that of its entities; and 

• Reviewing efficiency and effectiveness of internal controls over AFS preparation and 
reporting 

Specifically with regards to Annual Financial Statements, the Audit Committee should: 
Review and challenge where necessary: 

• Arithmetical accuracy and consistency; 

• Consistency of, and any changes to, accounting policies, comparing to prior years; 

• Methods used to account for significant or unusual transactions where different 
approaches are possible; 

• Whether the Municipality has followed appropriate accounting standards and made 
appropriate estimates and judgements, taking into account previous audit outcomes; 

• The quality of disclosure in the Municipality’s financial reports and the context in which 
statements are made; 

• All material information presented with the financial statements, such as the operating 
and financial review and the corporate governance statement (insofar as it relates to the 
audit and risk management); 

• All material issues in prior reports by the AGSA have been appropriately accounted for, 
resulting in fair presentation; 

• Conduct Analysis of trends and other financial ratio calculations e.g. year-on-year 
comparisons and composition of primary group e.g. salaries as a component of 
operations, whether operations are undertaken on a sustainable basis, operations at 
surplus or deficit, efficiency and solvency ratios, etc. 

Risk Management Activities 

The accounting officer is responsible for the establishment of effective risk management 
within the municipality. 

The responsibilities of the audit committee with respect to risk management must also be 
detailed in the audit committee charter. It is expected that the committee will provide an 
independent and objective view of the effectiveness of the municipality’s risk management. 
Where there is a separate risk management committee, the audit committee will be required 
to review recommendations made and consider these in line with the audit committee 
charter. 
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The audit committee must also provide feedback to the accounting officer and municipal 
council on the adequacy and effectiveness of risk management in the municipality and its 
entities. 

In the case where there is no separate risk management committee, the oversight 
responsibilities of the audit committee on risk management must be reflected in the charter 
of the audit committee, approved by council. 

Control Environment 

The audit committee members need to have a good understanding of the control 
environment, in fulfilling this responsibility the committee should: 

• Ensure that management follows a sound process to draw conclusions on the adequacy 
and effectiveness of the system of internal control; 

• Establish whether management has relevant policies and procedures in place and that 
these are adequate, effective and regularly updated; 

• Determine whether appropriate processes are followed and complied with on a regular 
basis; 

• Consider measures applied on any required changes to the design or implementation of 
internal controls; 

• Assess steps taken by management to encourage ethical and lawful behavior; financial 
discipline and accountability for use of public resources. 

Performance Management 

Part of the responsibilities of the audit committee includes the review of the performance 
management. The municipality must review its committees to ensure that in cases where 
there is an audit committee and a performance audit committee, that these are combined 
into one committee for effective management, oversight and reporting, as envisaged by 
section 166 of the MFMA. During the transition the chairperson of the performance audit 
committee should report progress on a quarterly basis to the audit committee. 

The audit committee members need to have a good understanding of the performance of the 
municipality and its entities. These include: 

• Review and comment on compliance with statutory requirements and performance 
management best practices and standards; 

• Review and comment on the alignment of the Integrated Development Plan, the Budget, 
Service Delivery and Budget Implementation Plan and performance agreements; 

• Review and comment on relevance of indicators to ensure they are measureable and 
relate to services performed by the municipality and its entities; 

• Reviews compliance with in-year reporting requirements; 

• Review the quarterly performance reports submitted by internal audit; 

• Reviews and comments on municipality’s and entities annual financial statements and 
timely submission to the Auditor-General by 31 August, each year; 

• Review and comment on the municipality’s and entities annual reports within the 
stipulated timeframes; and 

• Review and comment on the municipality's performance management system and make 
recommendations for its improvement. 
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Information Technology (IT) Governance 

The audit committee also needs to provide advice on IT governance, controls, access, 
safeguarding of information in the municipality and its entities. 

Specific expertise may be required from within or outside the municipality from time to time, 
to assist the internal audit unit and audit committee formulate recommendations on systems 
and controls. The committee may have to advise on the appropriateness of disaster 
recovery and continuity plans supporting IT risks, regular testing and evaluation of plans, 
systems and processes. 

Relationship with Stakeholders 

The audit committee is required to maintain good relations with key stakeholders, such as: 

• Municipal Council 

• Board of Directors of Municipal Entities 

• Municipal Public Accounts Committee 

• Finance Committee 

• Accounting Officer 

• Management and staff 

• Internal Auditors and External Auditors 

• Provincial Treasury 

• National Treasury 

Meetings 

The audit committee should meet as often as is required to perform its functions, but at least 
four times a year. 

The secretariat responsibilities are to be performed by the internal audit or as otherwise as 
determined by the accounting officer. This includes providing all administrative support to 
the audit committee meetings, sending invitations and documentation to members, 
coordinating and compiling of audit committee meeting documentation, taking minutes at 
audit committee meetings, preparing all logistical arrangements relating to audit committee 
meetings, including arrangement for the prompt payment of claims and fees, etc. 

The head of internal audit, in consultation with the audit committee secretariat in the 
municipality or municipal entity, must ensure that the required preparation for the meeting of 
the audit committee is finalized at least 7 days before the commencement of the meeting 
and that substantive work would be undertaken for the duration of the meeting. 

The following persons must have a standing invitation to the audit committee and attend all 
meetings: 

• Municipal Manager; 

• Accounting Officer of the Entity; 

• Head of Internal Audit of the municipality; 

• Chief Financial Officer; 

• External Auditor; 

• Provincial Treasury; 

• National Treasury; and 

• Any other person on invitation by the chairperson of the Audit Committee. 


Internal Audit and Audit Committee 
November 2012 


Page 14 of 25 


MFMA Circular No 65 


The chief audit executive, in consultation with the chairperson of the audit committee, must 
determine the time frames of all meetings. In light of the financial implications, the 
accounting officer in consultation with the chairperson of the audit committee must agree, if 
meetings go beyond a one day sitting. 

Part 2 

Internal Audit 

Section 62 of the MFMA requires amongst others, that the accounting officer of a 
municipality must take all reasonable steps to ensure that the municipality has and maintains 
effective, efficient and transparent systems of internal audit operating in accordance with any 
prescribed norms and standards. 

Establishment of Internal Audit Activity 

Section 165 of the MFMA prescribes the establishment of the internal audit activity. Internal 
audit is an important component of internal control, risk management and corporate 
governance and provides the necessary assurance and advisory services to the 
organisation. 

Internal audit activity is one of the most significant management tools and can provide value- 
added services to the municipality or municipal entity. When objectively and adequately 
resourced, internal audit should be in a position to provide management with assurance 
regarding the effectiveness of the system of internal control, risk management and 
governance processes. 

Identifying the Chief Audit Executive (Head of Internal Audit) 

The role of the chief audit executive is to provide advice, counsel, and opinion regarding the 
organisation’s efficiency and effectiveness in risk management, internal control and 
governance processes and performance management. The chief audit executive should be 
permanently appointed at a senior manager level, reporting directly to the Municipal 
Manager. 

The incumbent should possess high level of personal and professional ethics including an 
understanding of the risk management processes and practices. 

The chief audit executive should preferably possess any the following qualifications: 

• Post graduate degree in Auditing and/or Accounting; 

• Professional designation such as Certified Internal Auditor and other relevant 
professional designation. The incumbent should preferably possess the following: 

• At least five (5) years in internal audit management; and 

• Membership of the Institute of Internal Auditors. 

Independence is enhanced when the audit committee concurs in the appointment or removal 
of the chief audit executive. 


Independence and Objectivity 

The chief audit executive must report at a level within the municipality or municipal entity that 
allows the internal audit activity to fulfill its responsibilities. This level must have sufficient 
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authority to promote independence and to ensure broad coverage, adequate consideration 
of engagement communication and appropriate action on engagement recommendations. 

The chief audit executive must report functionally to the audit committee, and 
administratively to accounting officer. Independence is achieved through the organisational 
status and the objectivity of internal audit activity. 

Internal audit activity is independent when it can carry out its work freely and objectively and 
has the support of senior management and audit committee. 

The chief audit executive should have direct communication with the accounting officer, 
audit committee, municipal council, and other appropriate governing authorities. 

Direct communication occurs when the chief audit executive regularly attends and 
participates in meetings which relate to its oversight responsibilities for auditing, financial 
reporting, corporate governance and control. The attendance and participation of chief audit 
executive at these meetings provide an opportunity to exchange information concerning the 
plans and activities of internal audit. 

Each internal auditor should have an objective attitude and should be in a sufficiently 
independent position to be able to exercise judgment, express opinions and present 
recommendations with impartiality. 

An internal auditor should be free from any conflict of interest arising from professional or 
personal relationships or other interests which he/she may be subjected to audit; and 

An internal auditor should be free from undue influence which restricts or modifies the scope 
or conduct of the audit work, or significantly affects judgment regarding the content of any 
audit report. 

Internal Audit Activity should: 

• Have no direct operational responsibility or authority over any of the activities reviewed; 

• Neither develop nor install systems or procedures, prepare records, or engage in any 
other activity that would normally be audited; 

• Not initiate or approve accounting transactions external to the scope; and 

• Avoid conflict of interest. 

The Internal Audit Charter 

The charter outlines the mandate of internal audit and serves as the statement of purpose, 
authority and responsibility. The charter must be in writing and address the following: 

• The internal audit’s purpose, authority and responsibilities; 

• The standards to be complied with; 

• The position of the internal audit within the organisation; 

• A description of assurance and nature of consulting services; 

• The period of review of the charter; 

• The appointment and the dismissal of the chief audit executive; and 

• Access to information, properties and personnel 

The charter must be approved by the audit committee and accepted by the accounting 
officer. 
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Organising the Internal Audit Activity 

The chief audit executive needs to direct supervise and manage the activities of internal 
audit activity. These include amongst others planning, resource management, 
implementation of operating policies and procedures, review of work, coordination of 
assurance activities and quality assurance. 

Developing an Internal Audit Strategic Plan 

The chief audit executive must establish risk-based plans to determine the priorities of the 
internal audit activity, consistent with the municipality’s goals. The internal audit activity’s 
plan as well as the fieldwork must focus on the risks to which the municipality and municipal 
entity is exposed. Developing a strategic audit plan follows a logical process as described 
below: 

Understanding the Environment 

• Strategic Overview - In order to identify the risks to which the municipality or entity is 
currently exposed, and those to which it is likely to be exposed in the future, an 
understanding of the strategic plan and objectives for the municipality or entity must be 
obtained. 

• A top-down view of the organisation is taken, to better understand the operational risks 
and controls for managing those risks. This view depicts the environment within which 
each municipality or municipal entity operates. 

• A detailed risk analysis of the municipality or municipal entity is conducted to identify 
those risks that impact on the achievement of objectives. 

• The data can be used to plan, direct a risk management approach and provide the basis 
for risk management activities. 

Developing operational internal audit plan 

The operational internal audit plan should be based on an assessment of risks and 
exposures that may affect the municipality or municipal entity and should be done at least 
annually in order to reflect the most current strategies of the municipality. 

Risk assessment should be evaluated, alignment of the operational plan to the overall 
objectives of the municipality should be ensured. 

The chief audit executive must ensure that strategic and operational plans are developed 
annually, approved by the audit committee and accepted by the accounting officer. 

In developing the operational internal audit plan the following key issues must be 
remembered: 

• Completeness of the risk assessment report of the municipality 

• Availability (capacity) and skills of internal audit staff; 

• Changes in the risk environment of the organisation - the risk environment should be 
assessed on an annual basis; 

• Approval and acceptance of the operational plan by the audit committee; and 

• The materiality of ad-hoc requests as this could have a significant impact on the normal 
audit planning and timing process. 
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The operational internal audit plan should be risk-based and must be developed taking into 
account the results of the risk assessments and the integrated plan so as to: 

• Determine focus areas for internal audit activities; 

• Determine internal audit scope in relation to the scheduled assignments; 

• Allocate resources to planned audit assignments; 

• Establish the timing of performance of the audit assignments; and 

• Determine the reporting requirements and deadlines. 

The operational internal audit plan should be submitted to management for input prior to 
approval by the audit committee. 

The operational internal audit plan should be reviewed to identify any amendment needed to 
reflect changing priorities and emerging audit needs. 

The audit committee should approve material changes to the operational internal audit plan. 

Types of audits 

• Risk based audits 

Given the results from the risk assessments performed (which generally indicate only 
adequate-to-weak control environments) it may be appropriate for internal audit to focus 
its attention on the high risk areas, mostly concentrating on ensuring that key controls 
are in place and adhered to. 

• Cyclical audits 

Internal audit may decide to focus its attention on certain medium to lower risk areas, in 
order to achieve general or specific improvements in the control environment or culture. 
These cyclical audits are normally conducted on a yearly basis with the aim of monitoring 
and maintaining (through the reports issued and actions taken) a sound internal control 
environment. This also includes legislated and follow up audits. 

• Ad hoc requests 

Internal audit may consider ad-hoc requests from management, but such requests 
should flow from the written authorised charter and with the approval of the audit 
committee. However before accepting these requests the chief audit executive should 
assess the requests against the planned audits and prioritise them based on how much 
value can be added, prior to deciding whether or not to accept the requests. 

Resource Requirements 

The budget of internal audit is the responsibility of the accounting officer, audit committee 
and chief audit executive to ensure that the internal audit activity is adequately resourced for 
effective functioning. The chief audit executive should have control and responsibility over 
the internal audit budget. The budget should at least cover the following items: 

• Personnel related expenditure; 

• Capital expenditure and software; 

• Training and development; 

• Institute of Internal Auditors membership fees; and 

• Quality assurance programs. 
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The chief audit executive, in conjunction with the accounting officer, should develop an 
internal audit structure taking into cognizance the size of the municipality including risk and 
complexity of the operations. 

Provision should be made for levels of supervision and review of audit work in line with due 
professional care as provided for in the International Standards for the Professional Practice 
of Internal Audit. 

The chief audit executive should develop recruitment, placement, training and staff retention 
programme to ensure that appropriate skills are available. To achieve this, emphasis should 
be placed on qualifications, skill and experience. 

To improve effectiveness of internal audit, staff at all levels should have well-documented 
job descriptions, performance evaluations and training programmes. 

Outsourcing or Co-Sourcing of Internal Audit Activity 

The internal audit activity may be outsourced where the municipality requires capacity to 
develop its internal capacity and is deemed to be cost effective. Outsourcing should comply 
with supply chain management process. In situations in which the internal audit is 
outsourced, oversight and responsibility for the internal audit activity cannot be outsourced 
and must be maintained by management. The chief audit executive should manage the 
outsourced function. Consideration for evaluating sourcing alternatives: 

• Available resources: the municipality or municipal entity may not have sufficient 
resources (financial, physical, human etc.) to establish an in-house internal audit activity. 
Outsourcing should be considered when it is cost effective for the municipality or 
municipal entity; 

• Size of the municipality. Common reasons include temporary staff shortages, specialty 
skills, special audit project work and supplementary staff to meet deadlines and 

• Skills transfer: skills transfer implementation plan should be developed to ensure that the 
internal audit staff members are capacitated and their skills enhanced throughout the 
process. 

Types of sourcing alternatives: 

- Outsourcing : is where the internal audit is conducted by an external service provider; 

- Co-sourcing : is where the external service provider works together with in-house 
internal audit resources; and 

- Shared Services: is where one internal audit activity provides services to multiple 
organisations through a centralized internal audit. Implementation of the required 
work to be undertaken is based on Service Level Agreements with the municipality 
serviced by the Shared Service. 

Quality Assurance and Improvement 

The activities of the internal audit must be guided, monitored and supervised at each level of 
operation to ensure that they are consistently performed in accordance with the International 
Standards for the Professional Practice of Internal Audit. The quality assurance and 
improvement programme should include periodic internal assessments within a short time 
prior to an external assessment which can facilitate and reduce the cost of the external 
assessment. 
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Internal Assessments 

The chief audit executive must ensure that internal assessments are performed. Internal 
assessments should include ongoing reviews of the performance of the internal audit 
activity. These should be performed through self-assessment or by other persons within the 
municipality with knowledge of internal audit practices and the IIA Standards. The chief 
audit executive, at least annually, must report on the results of internal assessments. 

Internal assessments should appraise among others, compliance with the legislative 
framework, definition of internal auditing, standards, internal audit charter, code of ethics and 
methodology. 

External Assessments 

The internal audit must be subjected to an external assessment at least once every five 
years, the results of which should be communicated to the audit committee and accounting 
officer. An external assessment must be conducted by a qualified reviewer or review team 
from outside the municipality. 

On completion of the external assessment, the review team should issue a formal report 
containing an opinion. The chief audit executive in consultation with the accounting officer 
should prepare a written action plan in response to comments and recommendations in the 
report. 

Coordination of efforts with other assurance providers 

Internal audit should share information and co-ordinate its activities with other assurance 
providers within the municipality or municipal entity. This is done to ensure appropriate 
coverage of risk areas and minimise duplication of efforts. 

There should be access to each other’s audit plans and audit reports. There should be 
periodic meetings held between internal audit and external audit. At these meetings key 
risks, audit scope and audit findings should be discussed and priorities should be 
emphasized. 

Nature of Work 

Governance 

Internal audit activity must assess and make recommendations for improving governance 
process in its accomplishment of the following objectives: 

• Promoting appropriate ethics and values within the municipality; 

• Ensuring effective organizational performance management and accountability; 

• Communicating risk and control information to appropriate areas of municipality; and 

• Coordinating the activities of and communicating information among the audit committee, 
external, internal auditors and management. 

Risk Management 

Internal audit is responsible for providing assurance to management and the audit 
committee on the adequacy and effectiveness of the risk management process. Risk 
management is a key responsibility of the accounting officer and management. 
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Management should ensure that adequate risk management processes are in place and 
functioning as intended. Internal audit must assist management and the audit committee by 
examining, evaluating, reporting and recommending improvements on the adequacy and 
effectiveness of management’s risk processes. Conducting assessments and reporting on 
the organisation’s risk management process should be a high audit priority. 

• Risks arising from business strategies and activities should be identified and prioritised. 
These risks should focus on the efficient, economic and effective use of resources, as 
well as any duplication of functions that might exist; 

• Management should determine the level of risk acceptable to the municipality; 

• Risk mitigation activities should be designed and implemented to reduce or manage risk 
to a level acceptable by the municipality, and 

• Management should receive periodic reports of the results of risk management 
Processes. 

Control 

Based on the results of the risk assessment internal audit must evaluate the adequacy and 
effectiveness of controls encompassing the municipality’s governance, operations, and 
information systems. 

The following aspects should be considered when assessing controls for adequacy: 

• The control environment and management attitude towards controls; 

• Standard control practices; and 

• Compliance with other generally used control frameworks. 

If the controls are adequate, the internal auditor should evaluate the controls for 
effectiveness. To ensure that the conclusions reached are correct and supported by 
acceptable evidence the auditors are required to analyse and evaluate the findings of the 
audit in order to determine whether the controls are effective or not. The auditor may reach 
one of the following conclusions when evaluating the controls for effectiveness: 

• Effective 

The existing controls are effective, i.e. they provide reasonable assurance that the 
activity will achieve its performance objectives. 

• Ineffective 

The existing controls are ineffective, i.e. they do not provide reasonable assurance that 
activity will achieve its performance objectives. 

Audit Process 

Internal audit work must be conducted in accordance with the standards set by the Institute 
of Internal Auditors (IIA) Incorporated. These are the standards referenced to in section 
62(c) (ii) of the MFMA. The audit process includes engagement planning; performing the 
engagement; communicating results; and monitoring. 
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Engagement Planning 

Internal audit must develop and document a plan for each engagement, including the 
engagement’s objectives, scope, timing and resource allocations. Engagement planning 
involves consideration of objectives of the activities being reviewed, scope, resource 
allocation and the work program. Engagement planning can be divided into the following: 

• Planning considerations; 

• Engagement objectives; 

• Engagement scope; 

• Engagement resource allocation and 

• Engagement work program. 

Performing the Engagement 

Performing the engagement involves conducting field work to ensure that the objectives of 
the audit are achieved. This includes review, analysis and verification of information 
contained in documents, physical items, and corroboration by officials. 

Performing the engagement should include, amongst other, issues identifying information; 
analysis and evaluation; documenting information, and engagement supervision. 

The auditor can obtain information from a number of sources, namely: 

• Discussions with the municipality’s staff involved in the process; 

• Policy documents prepared by the municipality; and 

• Other relevant sources internally. 

Information must be sufficient, competent, relevant, and useful to provide a sound basis for 
engagement observations and recommendations. 

Internal auditors must document relevant information to support the conclusions and 
engagement results. 

The design and content of the working papers will depend on the nature of the engagement 
and the policies and methodology adopted by the internal audit activity. 

Working papers are the property of the municipality or municipal entity and must be under 
control of internal audit activity. 

Access to working papers should be restricted to authorised personnel. A policy should be 
in place to address access requirements and procedures. The policy should also address 
retention of records in line with policies of the municipality or municipal entity. 

Supervision is a process that continues throughout the engagement. The extent of 
supervision depends on the experience and proficiency of internal auditors assigned to the 
engagement and the complexity of the engagement. There should be documented evidence 
of appropriate supervision. Supervision includes: 

• Assigning competent internal auditors to the engagement; 

• Staff training and development; 

• Approving the work program and ensuring that it is implemented; and 

• Ensuring engagement objectives are achieved. 
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Communicating Results 

Internal audit should communicate the results of the audit engagements to management by 
issuing an audit report. Findings should be included in the audit report and discussed with 
the client. It is important that agreement be reached regarding the facts of each matter 
included in the final report. 

The audit results should be communicated to the municipality and relevant senior and 
executive management. Communications must include the engagement’s objectives and 
scope as well as applicable conclusions, recommendations, and action plans. 

Internal auditors are encouraged to acknowledge satisfactory performance in engagement 
communications and where appropriate include the internal auditor’s overall opinion and/or 
conclusions. Recommendations may be general or specific and should address the root 
cause of the finding. 

Engagement results must be disseminated to those who are in a position to take corrective 
action or ensure that corrective action is taken. This may be: 

• The responsible unit manager; 

• Senior management; 

• Executive management; 

• Audit Committees; and 

• Other governance and oversight committees (where appropriate). 

The internal auditors must solicit comments from management timeously. Management 
must provide comments in accordance with the terms agreed upon in the engagement letter. 
Internal audit record all attempts to obtain management comments. 

The internal auditors should analyse the management comments received. The following 
should be considered: 

• The adequacy and relevance of management’s response to findings and 
recommendations; 

• Any disagreements raised by management on the findings; 

• Proposed actions by management; and 

• The impact of management’s actions on the report. 


Monitoring Progress 

Observations and recommendations requiring immediate action should be monitored by 
internal audit activity until corrected. Internal audit activity should ensure that actions taken 
by management address the identified deficiencies. A process should be developed for the 
implementation of management action plans. Responsibility for follow-up should be defined 
in the internal audit charter. 

Follow-up audits must be incorporated in the annual internal operational audit plan. Follow- 
up audits entail verification of implementation of management actions. The chief audit 
executive must establish procedures to include: 

• An evaluation of management response; 

• Verification of the response; and 
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• A follow-up engagement and reports submitted to Council to address actions not being 
implemented. 

Consulting Activities 

Consulting services should focus on assisting management in problem solving activities, 
achieving the municipality’s objectives, and add value to line and senior management. The 
charter should include the authority and responsibilities of consulting services. 

Types of Consulting Engagements 

Internal audit should obtain an understanding of the nature of the engagement to clearly 
articulate the terms of reference. Agreed upon procedures should be documented in the 
engagement letter and agreed upon with the client. 

The types of consulting work include the following: 

• Formal consulting engagements - those that are planned and subject to written 
agreement; 

• Informal consulting engagements - routine activities such as participation on standing 
committees, limited-life audit projects, ad-hoc meetings and routine information 
exchange; 

• Special consulting engagements - participation on dedicated teams such as system 
conversion team; and 

• Emergency consulting engagements - participation on a team established for recovery 
or maintenance of operations after a disaster or other extraordinary event, or a team 
assembled to supply temporary help to meet a special request or unusual deadline. 

Objectives, scope and limitations of the consulting assignment should be confirmed in 
writing in an engagement letter. The responsibilities of both management and internal audit 
should be defined and documented in the engagement letter that should be signed by both 
parties. 

All working papers prepared during the execution of the consulting engagement should be 
kept as evidence of conducting the procedures. 

Internal audit should communicate issues and preliminary results of the consulting 
engagement with line management during the conduct of the assignment. 

Report to management may either be oral by conducting a meeting session with line 
management or written updates can be provided to management. As agreed upon in the 
engagement letter, internal audit should report results of the consulting activity. 

Acceptance of Consulting Activities 

The following guidelines are provided for assisting the internal audit activity in accepting 
consulting activities: 

Some consulting activities are specifically identified in the approved internal audit annual 
plan; 

Other consulting activities are initiated by managers communicating directly; 
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The chief audit executive should request the audit committee’s approval for consulting 
activities that significantly affect the approved internal audit’s annual operational plan; 

The chief audit executive should consider the impact of independence and objectivity on 
the internal audit activity before acceptance of the consulting activities; 

The chief audit executive should consider whether the internal auditors have the requisite 
skills, knowledge, time and competencies to perform the proposed consulting activities and 

The chief audit executive should consider the risks associated with the proposed consulting 
activities. 


Conclusion 


The internal audit and audit committee may approach the relevant Treasury for assistance. 
To enable the internal audit units to discharge their obligations and audit committees to 
perform effectively, reports relating to non-compliance with the MFMA and other legal 
prescripts must be promptly submitted to the respective national and provincial treasury, in 
terms of section 74 of the MFMA. These reports will inform support and intervention 
measures. 

It is important that the accounting officer ensure that this Circular is brought to the attention 
of the Municipal Council, Board of Directors of municipal entities, the members of the audit 
committee, internal audit unit, and all other relevant officials. 

All comments on this Circular must be forwarded to the email below. You may also contact, 
Ms. Zolisa Zwakala, Internal Audit Support, on telephone 012 315 5088 for related matters. 


Contact 



Post Private Bag X1 15, Pretoria 0001 
Phone 012 315 5850 


Fax 012 315 5230 


Email - General mfma@treasury. go v.za 


Website www. treasury, go v.za/legislation/mfma 


TV Pillay 

Chief Director: MFMA Implementation 
23 November 2012 
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